The Syncthing Android drama is exploding

The second half of Catfriends response is so...strange. Like there is a code in there somehow. Like when captive soldiers blink morse code to signal theyre in danger on a terrorist video. Thats how it feels to me anyway.

as an ammendum to this comment edit, catfriend edited the post linked and added this to the end

Edit: Regarding @nel0x , they did not have any history with the Syncthing (Android) project nor an expressive public profile when they applied to take over the Google Play Store entry in Feb 2025. I accepted this and transferred - believing in good will and we agreed on their task to be publishing what was on my repository to Google Play after their review. If they now desire to make their own app, there is, unfortunately no way to clean up the confusion caused if it is called the same other than kindly asking them to rename it.

I don't use syncthing but posted that tweet because it seemed of potential relevance to the the rest of the community.

Yes. The relevant points are that Catfriend's repo was fully reset, no git history, multiple times this year, supposedly because of sensitive data that was mistakenly checked in. If that's the case, it might explain why shortly before Catfriend deleted his repo, he created an issue saying something along the lines of 'stop messing with my desktop', which could be read as a plea to hackers. The repo went dark, and someone else published it, with Catfriend's private signing key, which triggered automatic updates for some users, without them knowing the maintainer changed. They also claim to have Catfriend's github credentials. After staying quiet for a month, Catfriend recently posted on the syncthing forum saying that everything is dandy with the new maintainer, without addressing major concerns. Meanwhile, the new maintainer has made large changes to the codebase without public comments. The last two updates from the new maintainer have been reviewed independently, and reproducible builds are enabled to ensure the apk matches the sources. However, that is assuming that Catfriend's repo was safe to begin with. In the case of ongoing blackmail, malicious code could have been added during one of the repository resets, or in a large refactor commit.

The sad part is that Catfriend picked up this repo after Syncthing deprecated it, just for his friends and family. I don't think he is a professional developer, and he very obviously was overwhelmed by the project. Syncthing is a very juicy target for malicious state actors, and trust is crucial. I feel awful to say that I no longer trust Catfriend or his replacement, but the circumstances don't inspire confidence.

From my understanding the project Syncthing-fork changed owners. The original owners GitHub repo went down, and no announcement that it was changing hands. So it comes off as shady. Bit I may be missing some things here.

No, it's not Syncthing itself. That's owned and maintained by a completely different team. This is regarding Syncthing-Fork, which packages Syncthing into a neat Android app.

What do you mean by signed deploys? The APK is already signed, and this new person got the signing keys. I'm not sire any additional signing would have helped.

Stealing another comment's update (thanks @eager_eagle@lemmy.world ), because catfriend1 explicitly says the new maintainer reseachxxl was willingly given the key material, which is how the update was pushed in the first place l:

Update: it seems that as of a few hours ago, Catfriend1 broke the silence and confirmed the transfer to researchxxl:

Therefore, I did hand over all my stuff to my inheritant @researchxxl inluding the com.github.catfriend1* apps, digital signing material and wish them the best to fulfill the mission of carrying on the Syncthing-Fork app. :woman_technologist: We have met in online gaming and developing modding code together for a level that tells the story of a research station attacked by some alien-like monsters. Two players do have to cooperate on fixing electrical devices, a low power emitting nuclear reactor and avoiding a bath in acid. If you stumble upon the game, say hello to us during our test sessions. :slightly_smiling_face:

https://forum.syncthing.net/t/does-anyone-know-why-syncthing-fork-is-no-longer-available-on-github/25661/165

I would recommend pausing updates or trying another solution.

You can run syncthing in termux and autostart it with termux:boot, which seems to work pretty well.

If you have the scripting skills you can also do more advanced stuff like using termux:api to run it when charging only.

I thought syncthing had fallen out of favor some years ago. I have nextcloud but I don't currently use automatic sync so I can't compare them.